accessing internal web server with external IP

[rha298]

I'm trying to access unsuccessfully an internal web server by its external address through a PIX running 6.3. The PIX seems not to allow inbound packets from its own external address space. Is there any workarounds or fixes for this situation?

Thanks

Dick

 

[unclerico]

There are two ways to fix this:
1) Create a split brain DNS setup within your environment. Add a zone that identically mirrors your publicly hosted domain and create all of the necessary Host (A) records

or (preferred)

2) Alter your static NAT entry for this server like so:

Pix(config)# static (inside,outside) <outside_ip> <inside_ip> netmask 255.255.255.255 [b]dns[/b]

The dns keyword will rewrite the dns response. Here's a good link from Cisco regarding this:

http://www.cisco.com/en/US/products...uration_example09186a00807968d1.shtml#problem

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[rha298]

Thanks for the reply.

I saw that link and as soon as I saw ASA Version 7.2(1) I backed away since I'm have a old PIX 520 running 6.3 (5)

I had decided to run with option #1 until I replace the PIX with newer hardware.

Thanks again

I think I'm going to like this place!!

 

[Supergrrover]

If you use external dns you can also use the alias command

alias (inside) [External_IP] [Interal_IP] 255.255.255.255

or you can try dnat

Take a look at this -

http://www.cisco.com/en/US/products...ucts_tech_note09186a0080094aee.shtml#backinfo

Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[unclerico]

rha, that code is actually for both ASA 7.2 and PIX 6.2 and up. It's up to you either way.

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[rha298]

Thanks for your input. I finally had a chance to try Cisco docs that were posted. I see it build the out bound connections but it got torn down "bytes 0 SYN Timeout"

Dec 11 16:35:46 pix Dec 11 2008 17:09:13: %PIX-6-302013: Built outbound TCP connection 129887714 for DMZ1:172.30.150.20/443 (x.x.x.x/443) to inside:172.16.4.109/2743 (172.30.150.20/2743)


Dec 11 16:36:10 pix Dec 11 2008 17:09:37: %PIX-6-302014: Teardown TCP connection 129887167 for DMZ1:172.30.150.20/443 to inside:172.16.4.109/2738 duration 0:02:02 bytes 0 SYN Timeout


Dec 11 16:37:48 pix Dec 11 2008 17:11:15: %PIX-6-302014: Teardown TCP connection 129887714 for DMZ1:172.30.150.20/443 to inside:172.16.4.109/2743 duration 0:02:01 bytes 0 SYN Timeout

 

[rha298]

I spoke to soon. It is now working. thank you all very much. This has been nagging me for awhile

Thanks